The recent cybersecurity incident involving Japan Airlines, which exposed personal information belonging to approximately 92,000 passengers, highlights a serious challenge for enterprises that depend on third-party technology platforms to manage sensitive customer information.

The breach originated from unauthorised access to Amadeus's Passenger Service System, which supports airline reservations, ticketing and check-in operations. While most affected passengers had their names, reservation details and travel information exposed, approximately 2,000 customers also had more sensitive information potentially accessed, including passport numbers, contact details and frequent flyer information.

What makes this incident particularly concerning is that the unauthorised access reportedly extended over a period of more than three years, from August 2023 to September 2026. This raises important questions about continuous security monitoring, detection capabilities and visibility into third-party systems.

The exposure of passenger information can create significant privacy risks. Even without credit card details or passwords, travel itineraries, reservation identifiers and personal information can potentially be misused for targeted phishing, impersonation and fraudulent communications.

This incident also demonstrates how a vulnerability in a shared technology platform can affect multiple organisations. For enterprises, securing their own infrastructure is essential, but it is equally important to understand how external service providers access, process and protect customer information.

At GajShield, we believe Contextual Data Loss Prevention, identity-aware access controls and continuous monitoring of sensitive information should form an important part of enterprise cybersecurity. These capabilities can help identify unusual data access patterns, restrict unnecessary information transfers and reduce the risk of unauthorised disclosure when deployed across the relevant systems.

Organisations must also minimise the customer information shared with third parties, regularly review access privileges and ensure that technology partners maintain effective security controls and incident-response procedures.

The larger cybersecurity lesson is simple: Outsourcing technology does not mean outsourcing responsibility for customer data security.

Because customers trust your organisation with their information, regardless of how many external systems are involved in processing it.

Japan Airlines (JAL) has announced that a data breach at Amadeus's Passenger Service System exposed the data of about 92,000 customers. [...]

Source: Japan Airlines suffers third-party data breach exposing passenger info via Bleeping Computer — published 29 Oct 2026.